* Re: [PATCH] rapidio: fix a resource leak when rio_add_device() fails
2025-12-21 12:05 [PATCH] rapidio: fix a resource leak when rio_add_device() fails Haoxiang Li
@ 2025-12-21 12:20 ` Greg KH
2025-12-22 23:13 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: Greg KH @ 2025-12-21 12:20 UTC (permalink / raw)
To: Haoxiang Li
Cc: mporter, alex.bou9, akpm, dan.carpenter, linux, linux-kernel,
stable
On Sun, Dec 21, 2025 at 08:05:38PM +0800, Haoxiang Li wrote:
> If rio_add_device() fails, call rio_free_net() to unregister
> the net device registered by rio_add_net().
>
> Fixes: e8de370188d0 ("rapidio: add mport char device driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
> ---
> drivers/rapidio/devices/rio_mport_cdev.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
> index 995cfeca972b..4a804b4ad6f7 100644
> --- a/drivers/rapidio/devices/rio_mport_cdev.c
> +++ b/drivers/rapidio/devices/rio_mport_cdev.c
> @@ -1789,6 +1789,7 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv,
> err = rio_add_device(rdev);
> if (err) {
> put_device(&rdev->dev);
> + rio_free_net(net);
> return err;
Are you sure this is right? You aren't checking that rio_add_net() was
actually called. How was this tested? How was this found? What tool
was used to find it?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] rapidio: fix a resource leak when rio_add_device() fails
2025-12-21 12:05 [PATCH] rapidio: fix a resource leak when rio_add_device() fails Haoxiang Li
2025-12-21 12:20 ` Greg KH
@ 2025-12-22 23:13 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2025-12-22 23:13 UTC (permalink / raw)
To: Haoxiang Li, mporter, alex.bou9, akpm, dan.carpenter, linux
Cc: oe-kbuild-all, linux-kernel, Haoxiang Li, stable
Hi Haoxiang,
kernel test robot noticed the following build errors:
[auto build test ERROR on akpm-mm/mm-everything]
[also build test ERROR on linus/master v6.19-rc2 next-20251219]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Haoxiang-Li/rapidio-fix-a-resource-leak-when-rio_add_device-fails/20251221-201559
base: https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-everything
patch link: https://lore.kernel.org/r/20251221120538.947670-1-lihaoxiang%40isrc.iscas.ac.cn
patch subject: [PATCH] rapidio: fix a resource leak when rio_add_device() fails
config: x86_64-buildonly-randconfig-003-20251223 (https://download.01.org/0day-ci/archive/20251223/202512230711.jyQOu79S-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251223/202512230711.jyQOu79S-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202512230711.jyQOu79S-lkp@intel.com/
All errors (new ones prefixed by >>):
drivers/rapidio/devices/rio_mport_cdev.c: In function 'rio_mport_add_riodev':
>> drivers/rapidio/devices/rio_mport_cdev.c:1792:30: error: 'net' undeclared (first use in this function)
1792 | rio_free_net(net);
| ^~~
drivers/rapidio/devices/rio_mport_cdev.c:1792:30: note: each undeclared identifier is reported only once for each function it appears in
vim +/net +1792 drivers/rapidio/devices/rio_mport_cdev.c
1648
1649
1650 /*
1651 * rio_mport_add_riodev - creates a kernel RIO device object
1652 *
1653 * Allocates a RIO device data structure and initializes required fields based
1654 * on device's configuration space contents.
1655 * If the device has switch capabilities, then a switch specific portion is
1656 * allocated and configured.
1657 */
1658 static int rio_mport_add_riodev(struct mport_cdev_priv *priv,
1659 void __user *arg)
1660 {
1661 struct mport_dev *md = priv->md;
1662 struct rio_rdev_info dev_info;
1663 struct rio_dev *rdev;
1664 struct rio_switch *rswitch = NULL;
1665 struct rio_mport *mport;
1666 struct device *dev;
1667 size_t size;
1668 u32 rval;
1669 u32 swpinfo = 0;
1670 u16 destid;
1671 u8 hopcount;
1672 int err;
1673
1674 if (copy_from_user(&dev_info, arg, sizeof(dev_info)))
1675 return -EFAULT;
1676 dev_info.name[sizeof(dev_info.name) - 1] = '\0';
1677
1678 rmcd_debug(RDEV, "name:%s ct:0x%x did:0x%x hc:0x%x", dev_info.name,
1679 dev_info.comptag, dev_info.destid, dev_info.hopcount);
1680
1681 dev = bus_find_device_by_name(&rio_bus_type, NULL, dev_info.name);
1682 if (dev) {
1683 rmcd_debug(RDEV, "device %s already exists", dev_info.name);
1684 put_device(dev);
1685 return -EEXIST;
1686 }
1687
1688 size = sizeof(*rdev);
1689 mport = md->mport;
1690 destid = dev_info.destid;
1691 hopcount = dev_info.hopcount;
1692
1693 if (rio_mport_read_config_32(mport, destid, hopcount,
1694 RIO_PEF_CAR, &rval))
1695 return -EIO;
1696
1697 if (rval & RIO_PEF_SWITCH) {
1698 rio_mport_read_config_32(mport, destid, hopcount,
1699 RIO_SWP_INFO_CAR, &swpinfo);
1700 size += struct_size(rswitch, nextdev, RIO_GET_TOTAL_PORTS(swpinfo));
1701 }
1702
1703 rdev = kzalloc(size, GFP_KERNEL);
1704 if (rdev == NULL)
1705 return -ENOMEM;
1706
1707 if (mport->net == NULL) {
1708 struct rio_net *net;
1709
1710 net = rio_alloc_net(mport);
1711 if (!net) {
1712 err = -ENOMEM;
1713 rmcd_debug(RDEV, "failed to allocate net object");
1714 goto cleanup;
1715 }
1716
1717 net->id = mport->id;
1718 net->hport = mport;
1719 dev_set_name(&net->dev, "rnet_%d", net->id);
1720 net->dev.parent = &mport->dev;
1721 net->dev.release = rio_release_net;
1722 err = rio_add_net(net);
1723 if (err) {
1724 rmcd_debug(RDEV, "failed to register net, err=%d", err);
1725 put_device(&net->dev);
1726 mport->net = NULL;
1727 goto cleanup;
1728 }
1729 }
1730
1731 rdev->net = mport->net;
1732 rdev->pef = rval;
1733 rdev->swpinfo = swpinfo;
1734 rio_mport_read_config_32(mport, destid, hopcount,
1735 RIO_DEV_ID_CAR, &rval);
1736 rdev->did = rval >> 16;
1737 rdev->vid = rval & 0xffff;
1738 rio_mport_read_config_32(mport, destid, hopcount, RIO_DEV_INFO_CAR,
1739 &rdev->device_rev);
1740 rio_mport_read_config_32(mport, destid, hopcount, RIO_ASM_ID_CAR,
1741 &rval);
1742 rdev->asm_did = rval >> 16;
1743 rdev->asm_vid = rval & 0xffff;
1744 rio_mport_read_config_32(mport, destid, hopcount, RIO_ASM_INFO_CAR,
1745 &rval);
1746 rdev->asm_rev = rval >> 16;
1747
1748 if (rdev->pef & RIO_PEF_EXT_FEATURES) {
1749 rdev->efptr = rval & 0xffff;
1750 rdev->phys_efptr = rio_mport_get_physefb(mport, 0, destid,
1751 hopcount, &rdev->phys_rmap);
1752
1753 rdev->em_efptr = rio_mport_get_feature(mport, 0, destid,
1754 hopcount, RIO_EFB_ERR_MGMNT);
1755 }
1756
1757 rio_mport_read_config_32(mport, destid, hopcount, RIO_SRC_OPS_CAR,
1758 &rdev->src_ops);
1759 rio_mport_read_config_32(mport, destid, hopcount, RIO_DST_OPS_CAR,
1760 &rdev->dst_ops);
1761
1762 rdev->comp_tag = dev_info.comptag;
1763 rdev->destid = destid;
1764 /* hopcount is stored as specified by a caller, regardles of EP or SW */
1765 rdev->hopcount = hopcount;
1766
1767 if (rdev->pef & RIO_PEF_SWITCH) {
1768 rswitch = rdev->rswitch;
1769 rswitch->route_table = NULL;
1770 }
1771
1772 if (strlen(dev_info.name))
1773 dev_set_name(&rdev->dev, "%s", dev_info.name);
1774 else if (rdev->pef & RIO_PEF_SWITCH)
1775 dev_set_name(&rdev->dev, "%02x:s:%04x", mport->id,
1776 rdev->comp_tag & RIO_CTAG_UDEVID);
1777 else
1778 dev_set_name(&rdev->dev, "%02x:e:%04x", mport->id,
1779 rdev->comp_tag & RIO_CTAG_UDEVID);
1780
1781 INIT_LIST_HEAD(&rdev->net_list);
1782 rdev->dev.parent = &mport->net->dev;
1783 rio_attach_device(rdev);
1784 rdev->dev.release = rio_release_dev;
1785
1786 if (rdev->dst_ops & RIO_DST_OPS_DOORBELL)
1787 rio_init_dbell_res(&rdev->riores[RIO_DOORBELL_RESOURCE],
1788 0, 0xffff);
1789 err = rio_add_device(rdev);
1790 if (err) {
1791 put_device(&rdev->dev);
> 1792 rio_free_net(net);
1793 return err;
1794 }
1795
1796 rio_dev_get(rdev);
1797
1798 return 0;
1799 cleanup:
1800 kfree(rdev);
1801 return err;
1802 }
1803
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread